#!/usr/bin/env bash
# e2e_test.sh — the ccs_json_bench use case, end to end against
# b3u.dev.
#
# Source: authored in b3u_use_cases (the benchmarking article's
#   section 2 second block + section 5, made executable).
#
# Downloads the use-case code zip, lays out
# ~/ccsUseCases/ccs_json_bench, and builds scb_counts against the
# SCB C++ library delivered by the ccs_json use case. Ends at a
# BUILT executable — running the benchmark on the corpus is yours
# (the article's sections 3 and 5-7).
#
# PRECONDITION: the ccs_json use case's layout exists (run
# ccs_json/e2e_test.sh first — this script does not repeat it).
#
# Environment (same surface as the ccs_json script):
#   B3U_BASE, B3U_EMAIL, B3U_PASSWORD   required
#   B3U_DOWNLOADS                       default ~/Downloads
#   CCSUSECASES_ROOT                    default ~/ccsUseCases
#   CF_ACCESS_CLIENT_ID/-_SECRET        optional gateway headers

set -u

: "${B3U_BASE:?set B3U_BASE (e.g. https://b3u.dev)}"
: "${B3U_EMAIL:?set B3U_EMAIL}"
: "${B3U_PASSWORD:?set B3U_PASSWORD}"
DOWNLOADS="${B3U_DOWNLOADS:-$HOME/Downloads}"
ROOT_DIR="${CCSUSECASES_ROOT:-$HOME/ccsUseCases}"

CURL=(curl -s)
if [ -n "${CF_ACCESS_CLIENT_ID:-}" ]; then
  CURL+=(-H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID"
         -H "CF-Access-Client-Secret: ${CF_ACCESS_CLIENT_SECRET:?}")
fi

fails=0
pass() { echo "  PASS  $1"; }
fail() { echo "  FAIL  $1"; fails=$((fails+1)); }

mkdir -p "$DOWNLOADS"

echo "== 1. login =="
WALL_ALTERNATIVES="            Compile the grammar with a local cppcc if you have one
            licensed -- this archive ships the .sgr, which is the
            artifact the service would compile for you."

# ⚠ THE LOGIN MUST DIAGNOSE, NOT TRACEBACK. This piped curl straight
# into json.load, so ANY non-JSON reply -- a Cloudflare Access redirect,
# a 502, a captive portal -- surfaced as a raw Python JSONDecodeError
# followed by "check B3U_EMAIL/B3U_PASSWORD", which was both wrong and
# unactionable. Found by a user whose credentials were perfectly fine
# and who was told to check them anyway.
_lb=$(mktemp); _lh=$(mktemp)
code=$("${CURL[@]}" -o "$_lb" -D "$_lh" -w '%{http_code}' \
  -X POST "$B3U_BASE/login" -H 'Content-Type: application/json' \
  -d "{\"email\":\"$B3U_EMAIL\",\"password\":\"$B3U_PASSWORD\"}")
token=$(python3 -c 'import json,sys
try:    print(json.load(open(sys.argv[1])).get("session_token",""))
except Exception: print("")' "$_lb")
if [ -n "$token" ]; then
  pass "login -> bearer token"
else
  if grep -qi 'cloudflareaccess\.com' "$_lh" "$_lb" 2>/dev/null; then
    fail "login -- $B3U_BASE is behind a Cloudflare Access wall (HTTP $code)"
    echo "        The wall answers BEFORE the application does, so no"
    echo "        email or password can reach it. Your credentials are"
    echo "        not the problem."
    echo
    echo "        b3u.dev itself is open -- so a wall in front of it means"
    echo "        B3U_BASE is pointed at a PRIVATE host (a staging or"
    echo "        preview hostname), not at the public service. Check"
    echo "        B3U_BASE; it should be https://b3u.dev."
    if [ -n "${WALL_ALTERNATIVES:-}" ]; then
      echo "$WALL_ALTERNATIVES"
    fi
    # (CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET are honoured above
    # if you hold a service token for a private host. Reaching the
    # public service needs no token.)
  elif [ "$code" = 401 ] || [ "$code" = 403 ]; then
    fail "login -- rejected (HTTP $code). Check B3U_EMAIL / B3U_PASSWORD."
  elif [ "$code" = 000 ]; then
    fail "login -- could not reach $B3U_BASE at all (DNS, TLS or network)."
  else
    fail "login -- no session_token in the reply (HTTP $code)"
    echo "        first bytes: $(head -c 160 "$_lb" | tr -d '\r\n')"
  fi
  rm -f "$_lb" "$_lh"; exit 1
fi
rm -f "$_lb" "$_lh"
AUTH=(-H "Authorization: Bearer $token")

echo "== 2. download the use-case code zip =="
code=$("${CURL[@]}" "${AUTH[@]}" \
  -o "$DOWNLOADS/ccs_json_bench-code.zip" -w '%{http_code}' \
  "$B3U_BASE/usecases/ccs_json_bench-code.zip")
[ "$code" = 200 ] && pass "GET /usecases/ccs_json_bench-code.zip" \
                  || { fail "code zip download (got $code)"; exit 1; }

echo "== 3. lay out the working directory (the article's section 2) =="
mkdir -p "$ROOT_DIR/ccs_json_bench"
cd "$ROOT_DIR/ccs_json_bench"
mv "$DOWNLOADS/ccs_json_bench-code.zip" .
unzip -o -q ccs_json_bench-code.zip \
  && [ -f scb_counts.cc ] && [ -f makefile ] \
  && pass "code zip unpacked (scb_counts.cc + makefile)" \
  || { fail "unzip / members"; exit 1; }

echo "== 4. precondition: the ccs_json delivery layout =="
if [ -d "$ROOT_DIR/ccs_json/scbcpp" ] && [ -d "$ROOT_DIR/ccs_json/cpp" ]; then
  pass "ccs_json layout present (scbcpp/ + cpp/)"
else
  fail "ccs_json layout missing — run ccs_json/e2e_test.sh first"
  exit 1
fi

echo "== 5. build scb_counts =="
make CCS_JSON_HOME="$ROOT_DIR/ccs_json" > make.log 2>&1 \
  && pass "make (see make.log)" \
  || { fail "make failed (see $ROOT_DIR/ccs_json_bench/make.log)"; exit 1; }
[ -x scb_counts ] \
  && pass "scb_counts BUILT and executable" \
  || fail "scb_counts missing or not executable"

echo
if [ "$fails" -eq 0 ]; then
  echo "CCS_JSON_BENCH E2E: ALL PASS  (./scb_counts is ready;"
  echo "  fetch the corpus per the article's section 3 to benchmark)"
  exit 0
else
  echo "CCS_JSON_BENCH E2E: $fails FAILURE(S)"
  exit 1
fi